Language Injection Settings: SQL Injection

Name

The name of the injection.

Language

The language to be injected.

• ID: select the ID or the name of the language to be injected.

• Prefix: specify a sequence of characters to be added before the corresponding string value.

• Suffix: specify a sequence of characters to be added after the corresponding string value.

The prefix and suffix are optional.

Places Patterns

In this field, type the rules that define the context where you want CLion recognize literals as injections.

SQL element patterns:

Use SQL element patterns to identify SQL elements where a language injection applies. You can combine patterns to restrict matches by SQL dialect, function name, argument position, and number of function arguments.

• Base pattern:

  sqlElement().forDialects(<DIALECT>).functionArgument(<INDEX>, <FUNCTION-PATTERN>)

  sqlElement() starts a pattern for an SQL element. forDialects(<DIALECT>) restricts the match to the specified SQL dialect. functionArgument(<INDEX>, <FUNCTION-PATTERN>) further restricts the match to an element used as the function argument at the specified zero-based index. The function call must match <FUNCTION-PATTERN>.

• <FUNCTION-PATTERN>:

  sqlFunctionCall().name(<NAME>).params(<PARAMS-PATTERN>)

  sqlFunctionCall() starts a pattern for a function call. name(<NAME>) restricts the match to functions with the specified name. params(<PARAMS-PATTERN>) applies an additional condition to the function arguments.

• <PARAMS-PATTERN>:

  sqlExpressions().count(<MIN>, <MAX>)

  sqlExpressions() starts a pattern for a list of SQL expressions. count(<MIN>, <MAX>) restricts the match to lists containing from <MIN> to <MAX> expressions.

Combined example:

[Oracle] RegExp in REGEXP_LIKE

Built-in rule name: Oracle RegExp.

This pattern matches an SQL element in the Oracle dialect when the element is the argument at index 1 of a regexp_like function call that has two or three arguments.

The second argument of REGEXP_LIKE is the regular expression pattern, so CLion treats the matching string literal '^[a-z]+$' as a RegExp fragment:

More examples:

• [Oracle] XPath in XMLQUERY

  Built-in rule name: Oracle XPath.

  sqlElement().forDialects("Oracle").functionArgument(0, sqlFunctionCall().name("xmlquery","xmlexists"))

  This pattern matches the argument at index 0 of Oracle XMLQUERY and XMLEXISTS function calls.

  CLion treats the matching string literal '/catalog/book' as an XPath fragment:

  SELECT XMLQUERY( '/catalog/book' PASSING XMLTYPE('<catalog><book>SQL</book></catalog>') RETURNING CONTENT ) FROM dual;

  

• [Microsoft SQL Server] JSON in OPENJSON

  Built-in rule name: SQL Server JSON.

  sqlElement().forDialects("TSQL").functionArgument(0,sqlFunctionCall().name("openjson").params(sqlExpressions().count(1, 2)))

  This pattern matches the argument at index 0 of T-SQL OPENJSON calls with one or two arguments.

  CLion treats the matching string literal '{"name":"Alice","age":30}' as a JSON fragment:

  SELECT * FROM OPENJSON('{"name":"Alice","age":30}');

  

Multiple patterns

You can define multiple place patterns for a single injection rule. The injection activates if any of the patterns match (they are combined with OR logic). Add each pattern on a separate line.

Advanced

In this area, optionally specify additional settings to narrow the context where the injection rule is applicable and thus to enable more fine-grained control over the injection process.

• Value patterntype a regular expression that determines the context to inject the language into. By using the first capturing group of the patterns as the target for injection, you can configure the procedure to have the language injected only into values that match a certain pattern or into multiple parts that match the pattern.

• Single file - If the option is off, the fragments that match the value pattern are treated separately, as different "files" - for example from the fragment editor's viewpoint.

  If the option is on, the corresponding fragments are all merged together to form a single unit, or "file".

  Given the value pattern

  xxx (.+) yyy (.+) zzz

  and the fragment

  xxx select * yyy from family zzz,

  select * and from family are treated as two independent fragments (or "files") if the option is off. If the option is on, select * from family is treated as a single unit or "file".